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REMARKS 

The Examiner is thanked for the performance of a thorough search and for considering 
the references submitted in the Information Disclosure Statement that was filed on February 7, 
2006. 

Claims 1, 9, 16, 23, and 27-30 have been amended. No claims have been added or 
canceled. Hence, Claims 1-3, 6-18, and 21-30 are pending in the subject application. 

Each issue raised in the final Office Action mailed May 16, 2006 is addressed hereinafter. 

I. INTERVIEW SUMMARY 

A telephone interview in the subject application was held on August 10, 2006. Examiner 
Tran and Applicants' representatives Christopher J. Palermo and Stoycho D. Draganoff attended 
the interview. Claims 1 and 9 were discussed. The reference discussed was Proctor, U.S. Patent 
No. 6,530,024 (hereinafter "PROCTOR"). 

The Examiner indicated that Claim 1 (with the proposed amendment) appears to 
overcome the cited art but would be subject to an updated search. (The proposed amendment to 
Claim 1 has been officially submitted in this paper.) With respect to Claim 9, the Examiner 
requested clarification of the term "network performance information". The Applicants 
representatives pointed out to paragraph [0046] in the Specification that includes examples of 
network performance information, and proposed to amend Claim 9 accordingly. The Examiner 
indicated that as amended Claim 9 would appear to overcome the cited art but would be subject 
to an updated search. (The proposed amendment to Claim 9 has been officially submitted in this 
paper.) 

II. ISSUES RELATING TO THE CITED ART 
A. INDEPENDENT CLAIM 1 

Claim 1 has been rejected under 35 U.S.C. § 102(e) as allegedly anticipated by 
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PROCTOR. 

Claim 1 comprises the features of: 

creating and storing_a risk level of the user based on the second set of data, wherein the 
second duration of time is sufficient to collect historical data regarding past 
malicious activities of the user, and wherein the risk level is a discrete value 
representing a long-term measurement of the likelihood of the user harming 
the network; 

creating and storing a current alert level based on the first set of data, wherein the 
first duration of time is of a length appropriate for assessing current 
activities of the user, and wherein the current alert level is a discrete 
value representing a current measurement of the likelihood of the 
user negatively affecting the network; 

PROCTOR does not teach, describe, or suggest the above features of Claim 1. 

In general, PROCTOR describes a system with an adaptive feedback mechanism 
according to which, when a "security occurrence" is detected, one or more security-related 
policies (i.e. audit, collection, detection, or security policies) can be modified and the modified 
policies can be implemented in the network. (PROCTOR, Abstract; col. 2, lines 51-60.) 
Specifically, PROCTOR describes creating event log files and auditing events specified in an 
audit policy, collecting records from the event log according to a collection policy, performing 
security analysis based on the records collected from the audit logs according to a detection 
policy, and updating some or all of the policies depending on the results from the security 
analysis. (See, for example, Figs. 9 and 10; col. 11, lines 18-48.) Thus, the PROCTOR system 
determines a security response action based on detecting a "security occurrence", and not on any 
historical risk levels associated with a user (as featured in Claim 1) or on network health levels 
(as featured in Claim 9). 

As amended, Claim 1 clarifies features that were already included in the claim and that 

already differed from PROCTOR. Specifically, Claim 1 includes the features of: creating and 

storing a risk level of a user, where the risk level is a discrete value representing a long-term 
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measurement of the likelihood of the user harming the network; and creating and storing a 
current alert level, where the current alert level is a discrete value representing a current 
measurement of the likelihood of the user negatively affecting the network. Further, Claim 1 
includes the feature of automatically deciding on a course of action based on the risk level and 
the current alert level. Thus, in Claim 1 a course of action is automatically determined based on 
two discrete values, one of which is a risk level that represents the historical long-term likelihood 
of that user harming the network. Also, in Claim 1 the determined course of action may be 
adverse to the user even though one of the discrete values - the current alert level - is not 
sufficient on its own to establish whether the user is performing a malicious action. 

PROCTOR does not teach or suggest the above features of Claim 1. Specifically, 
PROCTOR does not describe that a course of action is determined based on two separate and 
discrete values that represent user risk level and current alert level. Further, PROCTOR does not 
describe or suggest that a user risk level (which is assessed based on the long-term historical 
activities of a user) is created, stored, and subsequently used to decide on a course of action that 
is implemented by network infrastructure elements. 

For the above reasons, PROCTOR does not teach all of the features of Claim 1. 
Therefore, Claim 1 is patentable under 35 U.S.C. § 102(e) over PROCTOR. Reconsideration 
and withdrawal of the rejection of Claim 1 is respectfully requested. 

B. INDEPENDENT CLAIMS 16 AND 29 

Claims 16 and 29 have been rejected under 35 U.S.C. § 102(e) as allegedly anticipated by 
PROCTOR. 

Claims 16 and 29 include features similar to the features of Claim 1 discussed above, 
except in the context of a method and an apparatus. Thus, Claims 16 and 29 are patentable under 
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35 U.S.C. § 102(e) over PROCTOR for at least the reasons given above with respect to Claim 1. 
Reconsideration and withdrawal of the rejections of Claims 16 and 29 is respectfully requested. 
C. INDEPENDENT CLAIM 9 

Claim 9 has been rejected under 35 U.S.C. § 102(e) as allegedly anticipated by 
PROCTOR. 

Claim 9 comprises the features of: 

assessing a health level based on the network performance information and the 

resource performance information; 
wherein the network performance information, on which the health level is based, 

comprises at least one of packet latency information, jitter information, 

packet loss probability (PLP) information, network throughput information, 

average network downtime information, mean time to repair information, 

and mean time between failure information; 
wherein the resource performance information, on which the health level is 

based, comprises at least one of DHCP server utilization information 

and ARP table utilization information; 

PROCTOR does not teach, describe, or suggest the above features of Claim 9. 

The Office Action asserts that PROCTOR describes these features of Claim 9 in col. 2, 
lines 47-50. This assertion is incorrect. PROCTOR describes that the definition of security- 
related policies (i.e. audit, collection, detection, or security policies) "is usually made based on 
the level of security desired for the network, considering the overhead associated with 
monitoring network activities and detection of security occurrences." (Col. 2, lines 47-50.) It 
seems that the Office Action incorrectly interprets the computing overhead (which is incurred for 
monitoring activities and for detecting security occurrences) to be equivalent to the network 
performance information featured in Claim 9. 

As amended, Claim 9 clarifies the network performance information feature that was 

already included in the claim and that already differed from PROCTOR. Specifically, Claim 9 

includes the feature of assessing a health level based on network performance information and 

15 

Attorney Docket No.: 50325-0800 



Ser. No. 10/688,051 filed 10/16/2003 
Rayes et al - GAU 2 1 34 (Tran) 
Reply to Final Office Action with RCE 

resource performance information, where the network performance information comprises at 
least one of packet latency information, jitter information, packet loss probability (PLP) 
information, network throughput information, average network downtime information, mean 
time to repair information, and mean time between failure information. Further, in Claim 9 the 
resource performance information comprises at least one of DHCP server utilization information 
and ARP table utilization information. 

PROCTOR does not teach or suggest the above features of Claim 9. Specifically, there is 
nothing in PROCTOR that indicates assessing a health level of a network based on any transport 
protocol level or network protocol level information, such as, for example, packet latency, jitter, 
packet loss probability, network throughput, and average network downtime. Further, there is 
nothing in PROCTOR that indicates assessing the health level based on DHCP server utilization 
and/or ARP table utilization. 

For the above reasons, PROCTOR does not teach all of the features of Claim 9. Thus, 
Claim 9 is patentable under 35 U.S.C. § 102(e) over PROCTOR. Reconsideration and 
withdrawal of the rejection of Claim 9 is respectfully requested. 

D. INDEPENDENT CLAIMS 23 AND 30 

Claims 23 and 30 have been rejected under 35 U.S.C. § 102(e) as allegedly anticipated by 
PROCTOR. 

Claims 23 and 30 include features similar to the features of Claim 9 discussed above, 
except in the context of a method and an apparatus. Thus, Claims 23 and 30 are patentable under 
35 U.S.C. § 102(e) over PROCTOR for at least the reasons given above with respect to Claim 9. 
Reconsideration and withdrawal of the rejections of Claims 23 and 30 is respectfully requested. 

E. INDEPENDENT CLAIMS 27 AND 28 
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Claims 27 and 28 have been rejected as allegedly unpatentable under 35 U.S.C. § 103(a) 
over PROCTOR considered alone. 

Claims 27 and 28 include features similar to the features of Claim 1 discussed above. 
Since PROCTOR does not describe or suggest these features, Claims 27 and 28 are patentable 
under 35 U.S.C. § 103(a) over PROCTOR for at least the reasons given above with respect to 
Claim 1. 

Further, each of Claims 27 and 28 introduces one or more additional features that are not 
described or suggested by PROCTOR, thus independently rendering the claim patentable over 
PROCTOR. Examples of such additional features include, but are not limited to, a fault 
management system and the functionalities thereof, and a performance management system and 
the functionalities thereof. However, due to the fundamental differences already identified, to 
expedite the positive resolution of this case a separate discussion of those features is not included 
at this time. Therefore, it is respectfully submitted that Claims 27 and 28 are allowable for the 
reasons given above with respect to Claim 1. Reconsideration and withdrawal of the rejections 
of Claims 27 and 28 is respectfully requested. 

F. DEPENDENT CLAIMS 2-3, 6-8, 17-18, AND 21-22 

Claims 2-3, 6-8, 17-18, and 21-22 have been rejected under 35 U.S.C. § 102(e) as 
allegedly anticipated by PROCTOR. 

Each of Claims 2-3, 6-8, 17-18, and 21-22 depends from one of independent Claims 1 
and 16, and therefore includes each and every feature of the independent base claim. Thus, each 
of Claims 2-3, 6-8, 17-18, and 21-22 is allowable for the reasons given above for Claims 1 and 
16. In addition, each of Claims 2-3, 6-8, 17-18, and 21-22 introduces one or more additional 
features that independently render it patentable. However, due to the fundamental differences 
already identified, to expedite the positive resolution of this case a separate discussion of those 
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features is not included at this time. Therefore, it is respectfully submitted that Claims 2-3, 6-8, 
17-18, and 21-22 are allowable for the reasons given above with respect to Claims 1 and 16. 
Reconsideration and withdrawal of the rejections of Claims 2-3, 6-8, 17-18, and 21-22 is 
respectfully requested. 

G. DEPENDENT CLAIMS 10-12, 15, AND 24-25 

Claims 10-12, 15, and 24-25 have been rejected under 35 U.S.C. § 102(e) as allegedly 
anticipated by PROCTOR. 

Each of Claims 10-12, 15, and 24-25 depends from one of independent Claims 9 and 23, 
and therefore includes each and every feature of the independent base claim. Thus, each of 
Claims 10-12, 15, and 24-25 is allowable for the reasons given above for Claims 9 and 23. In 
addition, each of Claims 10-12, 15, and 24-25 introduces one or more additional features that 
independently render it patentable. However, due to the fundamental differences already 
identified, to expedite the positive resolution of this case a separate discussion of those features 
is not included at this time. Therefore, it is respectfully submitted that Claims 10-12, 15, and 24- 
25 are allowable for the reasons given above with respect to Claims 9 and 23. Reconsideration 
and withdrawal of the rejections of Claims 10-12, 15, and 24-25 is respectfully requested. 
III. CONCLUSION 

The Applicants believe that all issues raised in the final Office Action have been 
addressed. Entry of the Request for Continued Examination filed concurrently herewith is 
respectfully requested. Further, for the reasons set forth above, the Applicants respectfully 
submit that all pending claims are in condition for allowance. Reconsideration of the present 
application is respectfully requested in light of the amendments and remarks herein. 

The Examiner is respectfully requested to contact the undersigned by telephone if it is 
believed that such contact would further the examination of the present application. 
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A petition for extension of time, to the extent necessary to make this reply timely filed, is 
hereby made. If applicable, a law firms check for the petition for extension of time fee is 
enclosed herewith. If any applicable fee is missing or insufficient, throughout the pendency of 
this application, the Commissioner is hereby authorized to charge any applicable fees and to 
credit any overpayments to our Deposit Account No. 50-1302. 



Respectfully submitted, 

HICKMAN PALERMO TRUONG & BECKER LLP 



Dated: August IM ,2006 




Stoycho D. Draganoff 
Reg. No. 56,181 



2055 Gateway Place, Suite 550 
San Jose, California 95110-1089 
Telephone No.: (408) 414-1080 ext. 208 
Facsimile No.: (408)414-1076 
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